PT-2010-1179 · Microsoft · Commerce Server+5

Published 2010-09-06 · Updated 2025-04-04 · CVE-2012-1856

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2003 SP3, 2007 SP2 and SP3, 2010 SP1 Microsoft SQL Server versions 2000 SP4, 2005 SP4, 2008 SP2, SP3, R2, R2 SP1, and R2 SP2 Microsoft Commerce Server versions 2002 SP4, 2007 SP2, 2009 Gold and R2 Microsoft Host Integration Server version 2004 SP1 Microsoft Visual FoxPro versions 8.0 SP1, 9.0 SP2 Microsoft Visual Basic 6.0 Runtime

Description The issue is related to the TabStrip ActiveX control in the MSCOMCTL.OCX component, which can allow remote attackers to execute arbitrary code via a crafted document or web page, triggering system-state corruption.

Recommendations For Microsoft Office versions 2003 SP3, 2007 SP2 and SP3, 2010 SP1, update to a version that includes the fix for the MSCOMCTL.OCX vulnerability. For Microsoft SQL Server versions 2000 SP4, 2005 SP4, 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, apply the relevant security patch to address the vulnerability. For Microsoft Commerce Server versions 2002 SP4, 2007 SP2, 2009 Gold and R2, update to a version that includes the fix for the MSCOMCTL.OCX vulnerability. For Microsoft Host Integration Server version 2004 SP1, apply the relevant security patch to address the vulnerability. For Microsoft Visual FoxPro versions 8.0 SP1, 9.0 SP2, update to a version that includes the fix for the MSCOMCTL.OCX vulnerability. For Microsoft Visual Basic 6.0 Runtime, apply the relevant security patch to address the vulnerability.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2022-04046

CVE-2012-1856

Affected Products

Commerce Server

Host Integration Server

Office

Sql Server

Visual Basic 6.0 Runtime

Visual Foxpro

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2012-1856 · Security Note
• https://bdu.fstec.ru/vul/2022-04046 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-060 · Vendor Advisory
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15447 · Note
• https://t.me/cvenotify/117885 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1856 · Note
• http://us-cert.gov/cas/techalerts/TA12-227A.html · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• http://securityfocus.com/bid/54948 · Note
• https://t.me/cvenotify/104952 · Telegram Post
• https://bugtraq.securityfocus.com/detail/504F5EB3.30705 · Note
• https://vuldb.com/ru/?id.5932 · Note